Module nl.altindag.ssl
Package nl.altindag.ssl.hostnameverifier

Class FenixHostnameVerifier

java.lang.Object
nl.altindag.ssl.hostnameverifier.FenixHostnameVerifier
All Implemented Interfaces:
HostnameVerifier
public final class FenixHostnameVerifier extends Object implements HostnameVerifier
NOTE: Please don't use this class directly as it is part of the internal API. Class name and methods can be changed any time. Instead use the HostnameVerifierUtils which provides the same functionality while it has a stable API because it is part of the public API.

This verifier does not accept addresses in the subjectDN:commonName attribute and it will not verify names or wildcards against the Public Suffix List. Therefore use of wildcards is not limited to subdomains.

This HostnameVerifier is copied from OkHttp library, see here for the original content: - https://github.com/square/okhttp/blob/69ae7f3e10dae0554f3181edaa52bcd77ee448ab/okhttp/src/jvmMain/kotlin/okhttp3/internal/tls/OkHostnameVerifier.kt#L1

  • Field Details

  • Constructor Details

    • FenixHostnameVerifier

      private FenixHostnameVerifier()

  • Method Details

    • getInstance

      public static HostnameVerifier getInstance()

    • verify

      public boolean verify(String host, SSLSession sslSession)
      Specified by:
      verify in interface HostnameVerifier

    • isAscii

      private boolean isAscii(String value)
      Returns true if the [String] is ASCII encoded.

    • getPeerCertificate

      private Optional<X509Certificate> getPeerCertificate(SSLSession sslSession)
      Returns the first certificate from the peer certificates if present.

    • verify

      private boolean verify(String host, X509Certificate certificate)

    • verifyIpAddress

      private boolean verifyIpAddress(String ipAddress, X509Certificate certificate)
      Returns true if [certificate] matches [hostname].

    • getSubjectAltNames

      private List<String> getSubjectAltNames(X509Certificate certificate, int type)

    • verifyHostname

      private boolean verifyHostname(String hostname, X509Certificate certificate)

    • verifyHostname

      private boolean verifyHostname(String hostname, String domainNamePattern)
      Returns true if [hostname] matches the domain name pattern.
      Parameters:
      hostname - lower-case host name.
      domainNamePattern - domain name pattern from certificate. Maybe a wildcard pattern such as `*.android.com`.

    • isHostnameInValid

      private boolean isHostnameInValid(String hostname)

    • toAbsolute

      String toAbsolute(String hostname)
      Normalize hostname by turning it into absolute domain names if it is not yet absolute. This is needed because server certificates do not normally contain absolute names, but they should be treated as absolute. At the same time, any hostname presented to this method should also be treated as absolute for the purposes of matching to the server certificate. www.android.com matches www.android.com www.android.com matches www.android.com. www.android.com. matches www.android.com. www.android.com. matches www.android.com

    • asciiToLowercase

      private String asciiToLowercase(String value)
      This is like [toLowerCase] except that it does nothing if this contains any non-ASCII characters. We want to avoid lower casing special chars like U+212A (Kelvin symbol) because they can return ASCII characters that match real hostnames.

    • verifyWildcardPattern

      private boolean verifyWildcardPattern(String hostname, String domainNamePattern)
      WILDCARD PATTERN RULES: 1. Asterisk (*) is only permitted in the left-most domain name label and must be the only character in that label (i.e., must match the whole left-most label). For example, *.example.com is permitted, while *a.example.com, a*.example.com, a*b.example.com, a.*.example.com are not permitted. 2. Asterisk (*) cannot match across domain name labels. For example, *.example.com matches test.example.com but does not match sub.test.example.com. 3. Wildcard patterns for single-label domain names are not permitted.